On this page

CWE-552: Files or Directories Accessible to External Parties

Weakness Summary

The product makes files or directories accessible to unauthorized actors, even though they should not be.

  • Canonical source: MITRE CWE-552
  • Published Atomicorp CVE observations: 16
  • Distinct affected products in those observations: 16
  • Active Atomicorp rules associated with this weakness: 15

Atomicorp Research Context

Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.

The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.

A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.

Selected Published CVE Observations

CVEVulnerabilityProductAtomicorp findingObserved rules
CVE-2017-14942Intelbras WRN 150 - Authentication Bypasswrn150Attack Blocked by Atomicorp390716
CVE-2026-34361HAPI FHIR: Unauthenticated SSRF via /loadIG Chains with startsWith() Credential Leak for Authentication Token Thefthl7 fhir coreAttack Blocked by Atomicorp337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022
CVE-2021-4463Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File DownloadBEMS APIAttack Blocked by Atomicorp344360 , 347009 , 390709
CVE-2024-6911PerkinElmer ProcessPlus <= 1.11.6507.0 - Local File InclusionprocessplusAttack Blocked by Atomicorp344365 , 347019
CVE-2026-53580Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download featureTriliumAttack Blocked by Atomicorp340007 , 347009
CVE-2020-17519Apache Flink - Local File InclusionflinkAttack Blocked by Atomicorp390709
CVE-2021-39316WordPress DZS Zoomsounds <=6.50 - Local File InclusionzoomsoundsAttack Blocked by Atomicorp340007 , 344360 , 347009 , 390709
CVE-2021-40150Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosuree1 zoom firmwareAttack Blocked by Atomicorp390716
CVE-2022-0656uDraw <3.3.3 - Local File Inclusionweb to print shop\Attack Blocked by Atomicorp344360 , 390709
CVE-2022-2627174cmsSE v3.4.1 - Arbitrary File Read74cmsAttack Blocked by Atomicorp340007
CVE-2022-33901WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Readmultisafepay plugin for woocommerceAttack Blocked by Atomicorp340748 , 344360 , 347006 , 347009 , 390709
CVE-2023-2766Weaver OA 9.5 - Information Disclosureweaver office automationAttack Blocked by Atomicorp390716
CVE-2025-11371Gladinet CentreStack & TrioFox - Local File InclusioncentrestackAttack Blocked by Atomicorp340007 , 344360 , 344365 , 347019
CVE-2026-29066TinaCMS - Path TraversaltinacmsAttack Blocked by Atomicorp347009 , 390709
CVE-2021-40149Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosuree1 zoomAttack Blocked by Atomicorp390716
CVE-2022-25497Cuppa CMS v1.0 - Local File InclusioncuppacmsAttack Blocked by Atomicorp340007 , 344360 , 390709

Associated Atomicorp WAF Rules

RuleStatusBehavior
337109Activedisruptive (deny)
337110Activedisruptive (deny)
340007Activedisruptive (deny)
340162Activedisruptive (deny)
340163Activedisruptive (deny)
340748Activedisruptive (deny)
344360Activedisruptive (deny)
344365Activedisruptive (deny)
347006Activedisruptive (deny)
347009Activedisruptive (deny)
347019Activedisruptive (deny)
390709Activedisruptive (deny)
390716Activedisruptive (deny)
398021Activedisruptive (deny)
398022Activedisruptive (deny)

MITRE associates this CWE with the following attack-pattern entries. These taxonomy relationships are context, not Atomicorp coverage claims:

CAPEC-150 , CAPEC-639